PaddyNewman

Are you willing to share to a non-customer what version you are on? I query as I have multiple instances, multiple versions and upcoming upgrades... be keen to know what is affected. Or at least can your Netsweeper support agent reach out to myself also/provide a reference?

If it was me at SB, I'd be capturing on the specific proxy you are going through at that point in time, maybe I'm just out of the loop, but Mikrotik are pretty cheap as far as I'm concerned, do they have any other options? Presumably they monitor your edge device? If they see no drops, does it even traverse their WAN. I don't know how they work but as it's Netsweeper and likely WAgent Auth, it's their own MPLS, which is why if they see no drops, I'd be looking at either routing being squiffy or the proxy, I'd be routing you to a specific one and monitoring when you call to say you are down to check you are hitting the bridge at least.

Hello! So I work on (mainly) the firewalling side but I also handle WebScreen. If you have issues with them and ideas to improve, I'm happy to talk. I would preface by saying that currently, I have no idea how you would be able to make firewall changes, ones in our core which handles inbound rules and ones on prem with you in a shared management platform for outbound (and inbound, but not the NAT) We couldn't give you access to the core one, 100% not as that's handling the whole of LGfL. Your school one, possibly, it's been asked about before. It's one of those things that could possibly be done, but you still will only have outbound rule configuration. Yes, the Excel spreadsheet is outdated as such, what would you prefer, other than direct firewall access? WebScreen is changing, can't really say much as I don't want to 'run my mouth' but it's my only real ongoing project which is taking up all my time, so the upgrades are coming, but what is it about WebScreen you dislike? Happy to make suggestions to all here. It sounds like we've left a sour taste in your mouth so I'd like to try and see what's gone wrong, but do be aware you can't fully open the LGfL firewall or filter, you need a second line or choose the Option 2 configuration. That's a raw feed on the router, you use your own firewall and filter and we revert our firewall to a basic configuration. As always happy to talk and thrash anything out, it helps improve the service and I'm all for that.

Hi John, Buried in something right now so can't go on the hunt, but within the MSI > Property area there is an NSEXCEPTIONS area. Mine currently has a 0 in there, but it can be amended. You should be able to extract your current exceptions and paste into that field directly from text. I can't recall right now as its in one of my hundreds of text files, but that lets you add to the bypassing list.

I use/test/PoC it here. Clients losing their network connection taking several reboots to get back onto the network No idea about that one, I certainly haven't seen that Whitelisting anything in the client requires a reinstall with an updated MST file file supplied from Netsweeper themselves? That seems a poor way of managing the software.. I am in the same boat, pushed out to an InTune managed device and could no longer manage as one of the items was being decrypted and didn't like it. You can do whitelisting yourself though within the NSEXCEPTIONS part of the MSI. General performance issues with delays accessing the web. If you run it on low end machines, I felt it was a bit iffy. Put on an older gen2 i5 laptop with 4GB RAM (!) and it felt remarkably doggy, but it is doing the SSL items locally and the laptop is a bit trash, same MSI on an gen6 i7 device with 8GB RAM, no problems. I feel its down to the local physical architecture at that point. filtering executables when our config states it should only filter browser traffic It definitely does EXEs, it shows you that in the list however you can add those exceptions also, they should be able to advise you on how to do this within the MSI, I don't think its documented on their support pages though.

Just from my personal usage of FortiGate filtering, I don't feel its education focused, not enough to be in a production education environment. Its probably a more personal opinion than anything else, but I've been in web filtering for 10 years and it just doesn't hit the mark for me. Big names like Netsweeper/Smoothwall/Sophos XG will be good contenders and have various £ points, you can also use the firewalling of FortiGate with the filtering of Netsweeper without double filtering by offloading the queries only to Netsweeper which is a good middle ground if you ended up wanting more than one appliance (unlikely but cool nonetheless)

You should do this from your machine, your machine is the one affected and to find the gateway it relies on arp entries. It asks who has 192.168.1.1 for ex, device on that responds with 192.168.1.1 is at 00:00:00: etc If you windows device is showing a MAC for the gateway but it differs to the one when its working (this is why you need to take note of it now, even if its just the first 6 digits) and when it doesn't work, see what it comes up with. you can also try a ping -a 192.168.1.1 (use your gw address) and if the name responds with something silly like randoms-Macbook, then you know where its at. Intermittent connections are annoying as hell, and it could be a terrible external connection, but for that you can use thinkbroadbands BQM.

As in it shows the routers IP then * * * ? You should type arp -a and take note of the gateway MAC address. When it goes down again, do the same and see if the MAC has changed. If it has someone is stealing the GW IP and thats going to be horrible to work out who, but will tell you some info with the MAC.

I still think the fact you can ping but can't go out is going to be internal and arp- a should hopefully highlight that with the gateway MAC. I had to deal with it recently where a student put his phone on a static IP which clashed with the router, but I've seen countless in the past. Windows will respond to ping, phones don't so was easy to track down on the edge device as I saw no pings to it, so they were sucked away before, which indicates stolen gateway IP.

arp -a in CMD when it goes down, does the DC and router have the correct MAC in there. If not, someone connecting to the WiFi with hardcoded DC/Router IP - seen it too many times to not look there.

If you are using WAgent, have you configured the MSI as a service install rather than application? Its in the MSI itself in 'Property' under NS_WAGENT_SERVICE default is 0, I set to 1. It then runs as a full on service rather than application in the background and continues to start if stopped. Found that fixed a load of timeouts and expired client issues.

Are you using WAgent or Client Filter? As ^ says, if you lock the machine, when you log back in there should be an event in the logs which is sending re-auth requests, says something like liger etc etc WAgent has resend flags but if its not a local/VPN or MPLS Netsweeper instance, WAgent doesn't work. If it is WAgent, you want a shorter resend (I use 360) and -i -l added to the string.

That is crazy speeds. Without giving too much info away, highest we have is 1Gbps with secondaries (some primaries too....) and no one (ok, maybe during speedtests) has hit their limit, that's large London secondary schools. I can't imagine how much of a 10Gbps connection a primary will use and I also wonder how much you could realistically push through it!

Hiya, We can do it both USO and preshared key if you need for shared devices/basic authentication etc. Feel free to call or have the LA buzz one of us and we can explain what you get authentication wise, but I'm sure they already know

Hiya, Not well versed in this, but we support it and can provide it to schools etc. I have no idea on the politics of being on a list etc, thats really not my jam. What I would say is your internal devices need to be taken in to account, we've got a school using WiFi6 and out of the 24 devices connected right now to that channel/setup, all are mobile devices/phones, so no laptops or Windows devices etc so worth taking that into account, you'll get a new WiFi set up for future-proofing, but your devices may not gain any benefit directly.

Seemingly things are coming back now?

We've had no luck changing DNS, we can't even route to the IPs.

Yup, something has gone pop within Sky, cannot access LGfL services, can get to the support.atomwide.com page but access to the public hosted auth fails. Tested from colleagues connection and internet is working but various hosts are not accessible, peering in Sky probably! ac.uk likely hosted by Janet under the hood, thats likely the problem.

A quick update, apparently you should see a yes/no rather than the DOB? Can you confirm if you see different? Happy to have a private message with screenshot or email me, [email protected] if you see otherwise?

Help is I strong word, but I can certainly relay it. I don't recall it ever being a problem, but I can check and ask. How did you comment to us before and I'll see where it got stuck. We use date of birth for validation purposes occasionally and it also helps determine staff and students so it's a 'required' field but if it's something that you want us to hide or something, I can ask, for sure! Can I be nosey and ask what the problem is, not in a rude way but it's handy to know why it's a problem and if we can make changes to ease the issues of others, it's something we will try and do What we can't do, is not use it, it's a required field from the MIS for staff and students I believe. Let me know, I've passed on to a colleague now but really helps having feedback and queries!

@minimoo Whilst its not directly on the homepage, Network Status > At a glance should give you the standard traffic light set up for your school. Green is obviously good, red is bad! If there is something more specific you want though? Happy to ask!

Assuming your Smoothwall has a block on QUIC? If not, add that in there sharpish.

Hi, Appreciate the kind words. For perspective, our monitor was about as red as it has been in a while for reasons posted here - https://www.computerweekly.com/news/252504039/Virgin-Media-outage-Electical-explosion-in-South-East-London-takes-down-network According to that case, an automatic alert from our monitor reported you down 15/7 @ 13:06. Was claimed by a colleague in 1.5 hours and our initial first ask for light information was given, purely as we couldn't see the kit as per my initial update here. Its the process we follow to rule out our firewall, we can build and ship one of those same day typically so if it was that, we would have built it then and likely booked it for a pre 10am delivery the following day. That is the reason for the light question, I can see from the case and the kit onsite, you would have had an alcatel or similar NTU which would show a lack of light on the fibre port which would mean we go straight to VMB. So thats just for clarity as to why we asked for the light, not berating you for not being able to see the light information, it happens, you could be at site A when site B goes down. The 'can I get to it' checks on our end would have failed as the 'down' marker is active, we cannot ping the management of the firewall so it means its down. I can see it was passed to our networking team, albeit late this morning which showed that the router had no connectivity from VMBs end, so a Virgin 'fault' and I use that word lightly as its sort of part of the wider outage yesterday not directly caused or avoidable by VMB. Should we have done more sooner, yes, I think we should. I am always on hand if our support team need a look in from a network perspective and I'll re-advertise that fact to them and also give them some additional checks they can possibly do, its coming up to the summer holidays and we have had a nice influx of staff so we will be training and this is something I can add to the current plan, so apologies for the delay on this one. I can't promise this for everyone as I'd need someone to do my job for me but if you experience an outage and you are truly stuck for an update, please call and ask for me. If I am available I will take the call, but hopefully you don't have any repeated outage like this again and if you do, its handled with a bit more of a hands on investigation at stage one. The support manager at AdEPT is aware of this post and is likely checking for updates also, so this will be something that will get looked in to in our upcoming training over summer, once again sorry it wasn't handled to your expectations and we will fix that!

Hi, Without getting myself in trouble, I'll try to explain what we see when you call in with an outage as that's your specific pointer here. As a starter, we can see if the firewall is up, we have an up or down marker on the support site deployment page, also if you call in and we cannot see your firewall, we can see your schools ranges highlighted in orange. We also have a tool that monitors every school firewall/core devices/services we host etc as any ISP/company tends to. I'm more than happy to go in to things deeper but this is extremely public and I know full well my managers (and above) are watching posts here so I do want to keep any 'company info' to a minimum, but we definitely know of your status when you call in. Typically we only ask for more when its 'orange' on our call log or 'red' on our actual real-time monitor. That is just to get an idea of what it could be, any red or orange lights are a worry, any blank lights with cables in are possibly a problem. For example on a Cisco 5508, an orange flashing status light can indicate hardware/storage faults on the firewall. That could simply need a reboot (maybe a 1 in 10) or a replacement (most likely). A static orange light could mean it doesn't even load from flash and its instant game over. If by some miracle they are all green AND you are down, the firewall could have locked up, not the technical term but they do this occasionally and a reboot will either fix, or take you to the orange flashing abyss. If it happens often, we'd replace the firewall (we do note when firewalls have routinely failed and mention it in internal updates in cases so we aren't just saying that to get you off the phone/close the case etc) I'm not senior, or indeed management in any way but I can point this to those with phenomenal cosmic powers to try and work out what happened with your call. Sorry you felt that way, I certainly would go through any standard checks one of which is getting a response from your firewalls management IP to make sure we haven't lost contact / check polling history for said device. That isn't standard as our helpdesk aren't typically able to SSH to firewalls, but they do have the monitoring tools in place. If it needs a bit more training then we shall do that! I like my job, so I don't want to start dropping anything here that could end up in my job being terminated, but I do also value the opinions of others who actually use the services, and I'd much rather you walked away happy, even if its not the answer you wanted. Do fire any concerns towards me, I am happy to assist but anything technically 'support' should remain in the LGfL realms as A - Everyone can see it here B - Its easier for escalation purposes and C - I'm not being paid right now, this is my free time and support out of hours when I could be watching some TV or filling my face with pizza just fills me with sadness that I'd rather not have Oh... from a non-business stand point, you must have had a really good talk talk employee, I left after a week:p Always happy to help! Paddy

These schools are mainly on our hosted exchange and there are no proxies here, most if not all of our schools are proxy free for the most part. It's very widespread even affecting our home machines when testing for users.